Subdomain Finder

Discover every subdomain tied to your domain — including the ones you forgot.

You probably know about www and mail. But what about that staging server from two years ago, the old app subdomain pointing at a server nobody patches, or the marketing microsite a contractor spun up? Forgotten subdomains are a favourite way in for attackers because nobody is watching them. A subdomain finder maps every host attached to your domain so there are no blind spots.

What it checks
  • Active subdomains across your domain, including legacy and staging hosts
  • Subdomains pointing at servers that may be unmaintained
  • Dangling DNS records that could be hijacked (subdomain takeover risk)
  • New subdomains appearing over time
  • Which subdomains are publicly reachable versus internal

Why it matters

Your attack surface is only as secure as its weakest host, and a forgotten subdomain is exactly that — running old software, unmonitored, but still trusted under your brand. Worse, a subdomain whose DNS points at a deprovisioned service can be claimed by an attacker. You can only protect what you know exists.

How BrandSentryPro does it

Add your domain and BrandSentryPro enumerates its subdomains, flags ones that look risky or abandoned, and alerts you when a new subdomain appears so it never goes unnoticed.

Frequently asked questions

What is a subdomain finder?
A tool that discovers the subdomains attached to a domain — for example app.example.com or staging.example.com — by querying public DNS data and certificate records. It reveals hosts you may have forgotten about.
Why do forgotten subdomains matter for security?
Unmonitored subdomains often run outdated software and never get patched, making them an easy target. A subdomain with a dangling DNS record can even be taken over by an attacker and used to impersonate your brand.
What is a subdomain takeover?
It happens when a subdomain still points (via DNS) to a third-party service that has been removed or expired, letting an attacker register that service and serve content from your subdomain. Finding dangling records early prevents it.
All in one place

Run this check automatically

Add a monitor and BrandSentryPro keeps every check running for you — with alerts the moment something needs attention.

Get started